Problem
OpenSEO can explain search visibility and traffic, but it cannot prioritize SEO work using a site's own completion funnel without receiving user-level analytics. That leaves operators unable to compare public landing pages by business outcome inside SAM or MCP.
Desired behavior
Add a project integration that creates one aggregate source and shows a 256-bit secret once. A site can then send one HMAC-signed, complete UTC snapshot per day. Each allowlisted public pathname contains only these counters:
- searches started
- searches completed
- searches with no results
- registrations completed
- checkouts started
- payments completed
The receiver should authenticate the exact request bytes, allow five minutes of clock skew, make exact retries idempotent, retain 400 days, and expose project funnel totals plus landing-page comparisons to SAM/MCP.
It should reject unknown fields, query strings, private or identifier-shaped paths, incomplete path sets, arbitrary batch identifiers, and any amounts, users, sessions, orders, emails, or search terms. no_data must stay distinct from zero.
Proof of concept
I have a POC based exactly on v0.1.7 (ac9ee482; local commit 9f04a3d) with a minimal settings card, D1/PostgreSQL schemas and migrations, one immutable receipt per source/day, lease-bound write attempts, a per-source ingestion throttle, and two read-only tools: get_first_party_funnel and get_first_party_landing_conversions.
The implementation includes focused security/query tests, the full test suite, static CI checks, production builds, a clean D1 migration, and execution of the PostgreSQL migration against PostgreSQL 17.
Would this aggregate-only contract be useful upstream before polishing the UI further?
AI assistance disclosure
OpenAI Codex assisted with implementation and test drafting. I reviewed the security model, corrected concurrency findings from an independent review, and ran the validation listed above.
Problem
OpenSEO can explain search visibility and traffic, but it cannot prioritize SEO work using a site's own completion funnel without receiving user-level analytics. That leaves operators unable to compare public landing pages by business outcome inside SAM or MCP.
Desired behavior
Add a project integration that creates one aggregate source and shows a 256-bit secret once. A site can then send one HMAC-signed, complete UTC snapshot per day. Each allowlisted public pathname contains only these counters:
The receiver should authenticate the exact request bytes, allow five minutes of clock skew, make exact retries idempotent, retain 400 days, and expose project funnel totals plus landing-page comparisons to SAM/MCP.
It should reject unknown fields, query strings, private or identifier-shaped paths, incomplete path sets, arbitrary batch identifiers, and any amounts, users, sessions, orders, emails, or search terms.
no_datamust stay distinct from zero.Proof of concept
I have a POC based exactly on v0.1.7 (
ac9ee482; local commit9f04a3d) with a minimal settings card, D1/PostgreSQL schemas and migrations, one immutable receipt per source/day, lease-bound write attempts, a per-source ingestion throttle, and two read-only tools:get_first_party_funnelandget_first_party_landing_conversions.The implementation includes focused security/query tests, the full test suite, static CI checks, production builds, a clean D1 migration, and execution of the PostgreSQL migration against PostgreSQL 17.
Would this aggregate-only contract be useful upstream before polishing the UI further?
AI assistance disclosure
OpenAI Codex assisted with implementation and test drafting. I reviewed the security model, corrected concurrency findings from an independent review, and ran the validation listed above.